Months 1-3 (Foundations — Parts 1-2 of this book):

Primary: TryHackMe "Complete Beginner" and "Jr Penetration Tester" paths - Secondary: PortSwigger Web Security Academy SQL Injection and XSS modules - Local lab: Kali + Metasploitable 2 (as built in this chapter)